Virus help!

[pin1onu]

Both pin1onu and locutus give good advice, but I'm not altogether convinced that this is a HOSTS file/DNS hijacking issue.

Host file was specifically mentioned in the definition I provided. I did toy with asking the OP to post but felt he might learn a bit from doing.

 

I agree that the MS updates issue also needs to be looked. However it is often a feature of this sort virus/malware that it blocks specific attempts (such as MS updates). I had a peice of Malware that persistently blocked the Hijackthis website. (Fortunately I had a copy loaded on USB).

[Tezcatlipoca]

Host file was specifically mentioned in the definition I provided. I did toy with asking the OP to post but felt he might learn a bit from doing.

 

Sorry, not trying to steal your thunder at all, I just think it might be equally helpful for the OP to post the HOSTS file so we have a reference to explain what, if anything, has hijacked hir. Either way, we're both moving in the same direction, so the OP is in good hands!

 

I'm also of the suspicion that something, be it DNS or otherwise, is fouling up the OP's ability to update via M$'s own site, hence the alternative WindizUpdate suggestion. I'm wondering whether they can surf to other sites which are classically blocked by malware (I'm thinking Spybot, HijackThis, and a whole raft of AV sites).

[dx100uk]

TBH: i'd stick it up on housecall and let that sort it out.

 

http://us.trendmicro.com/us/housecall/

 

too much like hardwork this thread.

 

dx

[kregrs]

I can surf to whatever sites, only in safe mode now though, as keep getting the blue screen when trying to start normally. Have got and run Malaware, it found the virus to start with and cleared it, and thats when the problems started! I'll do whats been asked above, probably be tomorrow now. The blue screen actually only made an appearance last week after I tried to burn a disc with Windows Media Player, restarted system and it seemed to clear. Then on Saturday, I again tried to burn a disc using Real Player and it shut down, blue screen ever since when trying to start normally. Also, WMP wouldn't run again after it shut down, but Real Player ran fine, was playing music no problem until I tried to burn a disc.

[kregrs]

Also, I'd very much like to try and sort this and hopefully learn something, especially in this climate, where I need to save money. So if I can save some money by not having to give it to the shop, I'm all ears...

[dx100uk]

ok well we need to get some basics done.

 

1st off i'd boot to safemode and run chkdsk

 

then i'd

 

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/system_file_checker.mspx?mfr=true

 

lets make sure we have a good foundation before we go further .

 

asap you need to get it into normal mode and run housecall.

 

then we'll go from there.

 

dx

[kregrs]

ok well we need to get some basics done.

 

1st off i'd boot to safemode and run chkdsk

 

then i'd

 

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/system_file_checker.mspx?mfr=true

 

lets make sure we have a good foundation before we go further .

 

asap you need to get it into normal mode and run housecall.

 

then we'll go from there.

 

dx

 

 

Is it just a simple case of typing chkdsk in 'run'? Same with commands on the link?

[sillygirl1]

Ta for this info, I have picked up an old virus from a memory stick and am redoing my laptop asa consequence. I'll report back if anything else has been found.

 

Second virus picked up this year via sorting out old data... no other viruses in the last 18 months!

[locutus]

Whilst booting press F8 to access the boot menu. Pick Safe mode with networking

 

Once booted, start>run type in the box CMD

 

In the black window that opens type chkdsk C: /F (will probably ask if you want to schedule a scan next boot, select "yes")

 

Now, reboot (this boot will take a long time so make a cup of tea and a sarnie )

 

then do the start>run type in the box CMD, then sfc /Scannow

 

then as DX said, HouseCall - Free Virus Scan visit that website.

[kregrs]

Whilst booting press F8 to access the boot menu. Pick Safe mode with networking

 

Once booted, start>run type in the box CMD

 

In the black window that opens type chkdsk C: /F (will probably ask if you want to schedule a scan next boot, select "yes")

 

Now, reboot (this boot will take a long time so make a cup of tea and a sarnie )

 

then do the start>run type in the box CMD, then sfc /Scannow

 

then as DX said, HouseCall - Free Virus Scan visit that website.

 

Done the above, when it came to sfc /scannow it came back with -

Windows File Protection could not initiate a scan of protected system files. The specific error code is 0x000006ba [The RPC server is unavailable.]

 

So... Whats that mean?

[locutus]

Try start>run type in the box sfc /Scannow

[kregrs]

Try start>run type in the box sfc /Scannow

 

Tried...

[dx100uk]

Windows File Protection may not start

 

dx

[kregrs]

Done the above, the certificate isn't missing, but it says its expired, as of 2004! So, do I still need to import a certificate from another computer, or is there anything else I can do?

[dx100uk]

Trusted root certificates that are required by Windows Server 2008, by Windows Vista, by Windows Server 2003, by Windows XP, and by Windows 2000

seems not.

 

 

i would now be inclined to boot from your OS disc and go thru the motions of re-installing the OS you use.

 

it should just repair [and i dont mean use the 'r' option either] the one that is one there already.

 

dx

[kregrs]

That could be a problem, I dont have any discs, never got any with the machine, it was 2nd hand.

[dx100uk]

well thats got to be your next step.

 

what OS is it?

and have you looked on the machine itself, sometimes there are hidden recovery partitions and/or a folder called I386 on the HDD that contains what you need.

 

give us a PC spec.

 

dx

[kregrs]

Sorry to be thick, all I know is it windows xp, any way of getting the machine to tell me?

[dx100uk]

what is the pc ? we've yet to get around to asking that info 43 posts in!

 

dx

[locutus]

1st post says XP

 

Right click "my computer" and select properties... it will tell us which version you are running.

[dx100uk]

begger it did.......

 

now we need to know the manu /model or is it home built.

 

dx

[kregrs]

It is a Packard Bell, on the back on a little sticker it says the model is Imedia 1318,

[Conniff]

Specifications

 

• Form Factor: µATX 24.4 cm x 24.4 cm
  
• CPU Support
  
  • Socket LGA775
    
  • Support Intel Pentium Hyper-Threading technology with FMB Performance 2004 support
    
  • Support for an Intel Pentium 4 processor in a LGA775 socket with an 800 MHz system bus, 2.8 GHz to 3.8 GHz or higher.
    
  • Support for an Intel Celeron processor in a LGA775 socket with a 533 MHz system bus, 2.8 GHz or higher.
    

  [*]System Memory

  • Supports 2 memory slots.
    
  • Supports a maximum memory size of 2 GB (using 2 x 1 GB memory modules)
    
  • 400/333/266 MHz
    
  • Support only 2.5 V DIMM DDRAM configurations
    
  • Unbuffered type support
    

  [*]Chipset

  • North Bridge: Core Logic 661FX
    
  • South Bridge: Sis 964 MuTIOL Media I/O
    

  [*]Integrated Video

  [*]Realtek ALC655 Audio System

  [*]Ethernet Controller: Realtek RTL8100(L) PCI/mini-PCI

  [*]I/O Controller: WINBOND W83627EHF I/O controller

  [*]Storage

  • 2x ultra 133 IDE
    
  • 2x Serial ATA with Raid 0 and Raid 1 configuration
    

BIOS Specifications

 

 

 

 

AMI BIOS, including support for:

• Plug and Play
  
• Advanced Configuration and Power Interface (ACPI) 1.0b
  
• S3 mode
  
• Desktop Management Interface (DMI 2.0)
  
• 4-Mbits flash device.
  
• Language supported: English
  
• POST
  

It's a very unsophisticated system, so don't expect too much performance.There are more components in a crystal set.

 

Edited December 17, 2009 by Conniff

[locutus]

Lots of Packard Bell PCs have a recovery partition... I think its f11 or f12 or alt f12 whilst the power on self tests are running (straight after you press the power button)

[Conniff]

With the Packard Bell Recovery Program you can restore the computer to its original state as when you acquired it. At the same time, it offers you the possibility to maintain the current configuration and personal data. This recovery process does not require any CD and it only takes approximately 10 minutes. You can start this process by pressing at start-up, or by clicking the appropriate icon in SmartRestore. Please refer to the chapter on Recovery in your User's Guide.

 

 

It is also possible to restore your system from a backup copy. Therefore, your Packard Bell computer contains the utility Master CD/DVD Creator, which allows you to transfer your computer's recovery data to a Master DVD or a set of Master CDs. This DVD or these CDs will then be required if you need to restore a program or the entire computer.

 

Note: When you create a Master DVD or Master CDs, you can choose to either retain your backup data on your hard disk or permanently delete it. We strongly recommend that you retain the backup data on your hard disk drive. If you delete the backup data, you will no longer be able to use all the options of the Packard Bell Recovery Program, the recovery process will take up to 1 hour, you will not be able to restore your personal data and settings, and you will have to install all drivers for your hardware one by one.

 

 

The version of Windows XP that has been installed on your computer is an OEM (Original Equipment Manufacturer) version. This version differs from the retail version (the regular Windows XP CD for sale in stores) in three ways:

• The license for the preloaded Windows XP that you buy together with your computer is linked to the computer and not to you. Although you are the legal owner of a Windows XP license, you are not allowed to install it on any other computer and you do not keep the license when you do not have the PC.
  
• Support on your OEM version of Windows XP (including any service packs you may install) is entirely done by Packard Bell and not by Microsoft. In fact, the Microsoft helpdesk will not take your call when your version of Windows XP came with your computer and refer you to the "original equipment manufacturer," in this case Packard Bell.
  
• The Windows XP CD contains the Microsoft Backup utility, which is not present in the OEM version.
  

When you use a regular Windows XP CD to restore the operating system, there is a chance that it damages or even deletes the Backup Partition -the section on your hard disk drive where all data is stored for recovering the system. You will then have to purchase a Master DVD to restore your computer's original software. Besides, it might void your software warranty.

 

Finally, you will not have any of the benefits of using the entire Packard Bell software that comes with your Packard Bell computer, including the licensed copy of Windows XP that you already paid for when you bought the computer. The Packard Bell preinstalled software has been developed for an optimal PC-experience: it provides qualified hardware drivers, diagnostic, backup and recovery software and InfoCentre, the main source of information about your computer hardware and software.